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PURPOSE: A network based IDS 
(Intrusion Detection System) is 
provided to enhance a packet 
catch performance by catching 
a small size packet in a high 
speed network without a loss 
and to fast and exactly detect 
the misuse and the abnormal 
activity in the network. 

CONSTITUTION: The system 
comprises an intrusion detect 
sensor(130) detecting the 
misuse through the pattern 
matching after collecting the 
packets by connecting to the 
network, and an intrusion detect 
server generating a normal 
profile for each source by 
receiving the packets collected 
by the intrusion detect sensor 
and detecting the abnormal 
activity. The intrusion sensor 
includes a packet collecting and 
distributing part collecting and 
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distributing the packet from the network, a pattern matching part detecting the 
intrusion by comparing the packet transferred from the packet collecting and 
distributing part with the previously stored pattern, a packet filtering and dissembling 
part dissembling the packet from the pattern matching part, and a distributing part 
for transferring the data from the packet filtering and dissembling part to the intrusion 
detect server. 

©KIPO 2003 



if display of image is failed, press (F5) 



http7/patent.kipris.or.kr/bin/Kpa_fulltext.cgi?appLno=1 02001 001 2532 2004-01-27 



WIPS PIView 3.3.2.: 





(19) PI§[eJ^^5lS(KR) 

V I ^-^ o -^n — i o -C vrAy 




(51) Int. CI. 
G06F 15/00 


(11) S^HBls 
(43) SJHSm 


^2002-0072618 
2002^09818^ 


(21) eseim 
(22) 


10-2001-0012532 
2001^03^12^ 




(7D m&zi 


(^)AilSOh 
442-380 

*«"A| 28-25 SS^S 4# 




(72) »g» 


305-333 

CHSSfiSAI Oi^e 52£XI 
§31^ 

441-837 

S^l 4^A| ^£±=? 5!^§ 1267 ^^th^Om^ 809-1106 




(74) CHB-loj 


442-800 

3Ji 4^ai oH&ne 139-24 




(77) &AF§^ 






(54) §§!g 







S LHIM?-IH^01IAH 01 ^CH XI dl§^°J S , 2§, ^§1 SAIS^I «e L)IM?43 31^ 8 &XIAI (network based IDS) Oil 

s» 3a 01 a. oia-iti- g g^ge goii s^got nH^e 4*3 a- * suidoHse §6H 2§§ ^xi mt= ggj^xi ^uah; §j m\ saBxi vim^^e\ 
ei mum ^sbfoi ^dHo^ mia^s » ^uh¥2k oiai nn&!g n^o[2 hh^i §y shh¥S^h eh^u* miimoi s 1 

3X1 Site nue QH£l¥; £M HUE! 0HS¥^¥Ei nH5L!e gSHShte SH^! ffiEig ^ ^oH¥: 3! £>0| HH^ UEI9 gJ ^6H¥^¥Ei & 

CHI 01 EH M SJEJ ^X| AHb-|^ SBo^l ?|» ^bH¥^ 0|^0)SD. 

S ^S0]| M U|eo, 3 3,1^ gojgjj Al^gg afH^ilCH 3|&S| HHid OH U ft 0|g6F°^ H^^OIIAH 5fg AhOJZE^J HH^£ ^^(loss)oHI 
3£H 5H^I^ 4 HH^i 5>H4N ^fei 100% Oil ^S"}! »#AIH ^ 0I0II WtZ\ &tt\M2\ 2§ I* XI dl§^ HJ^IM §^ 

SMI i^XIS 4^ S!§0l 91C[. 

£2 
SAilA] 

£ ie s arson a>e seiBxi ai^bs ggspi ^sh £ai°[ se^, 
£ 2^ s ^soii a>e ^^j^xi Ai^gsj £ai§[ M^soia. 

100: oj^uioooot 10: «m« Al^gj 
120: LH¥^o°ooi21~124: AI^U 
130: SEJ^XIAI^igjoo 
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200: SaSXI &!Aio<>2lO: EH^ g ^HH¥ 
220: flu tHfflg ^oo6230: 0H§j¥ 
240: EH^! liEIS £ ^6H¥°250: XHI2 tHHHii¥ 
260: ^dH^oooo270: IDSS 
280-1 -280-n: SSJ&XI AH tH 



S bH^oi^AhojiAH oi^CHIi^ dlg^^oj 2§, 3E y§i SfflBX|A|:*:B(IDS: Intrusion Detection System) Oil 

3» ^^S, CH^ ^AHIoh^lfe mm E^Si^ EH^!2| m&MZl CHI^?-|H J\^: S gJ&X|A|^H (network based IDS)0ll 5r 

el- 20ID. 

^J^eOH, IH^B gSEISI S^if °JEH^2l A>gO| gJ^SEIS/H &X\&?id{, 2XHfSL 2XfDj|i! g □ 2Xf UIXIU^l ^#2] 

3|£ »a5KQ 21 IQ. OJ CHI CCFEI 6H3-I2J BSEI dF0I£H^2| »S. H&KHMAI S6H S 3M5f2| «^|^0| AhSl^ gaigog 

QH%£i3 am. 

OiaB oH^o^l ¥|6H SOOI^AH i^&AWSKVPN: Virtual Private Net), (Firewall), S&&X|A|£B(IDS:lntrusion De 

tection System) gOI gB| SICK UE| »HS! (Firewall)^ 2J¥^¥EH Uj^^M Sta^l ¥|§[ }|^AH 2J¥2J 

¥Ei LH¥2| SSXF^M ^S5f3, oj ¥ ^ ¥Ei ^3H§S ^£JS »B8PI ?| & §^ OIS XIS!6[b ShHSIIOI ^ ^H^^ICHM tHelP. CO 
BU-i ^Sf^^ e!H«!jtt LH¥aSI 33l¥^0|| ^JHSKM Iff eXHIofe Jl^g ofDI, Li|e°|a ^BH^i°l III msatOh ^£H^! 

21 XI2 A|3|^ ^XHISOI SICK SgJ&X|A|^B(IDS)g LH¥^0IU s^^OII o\0\ U2J21 EH id QIOI EH bHI 01 SS^AI^glS A> 

§6H Ul^^iaU A|^S2| A[g§ ^ AIZJ- SL| EH H 61- CM ggje BXIotfe 2I^0|CK dFEJ-AH gjs^jfl- SSBXI AI^BS 0|g6h£ SgJ#B0|| 
^EHS^CH^E HI oHM il^o[2, LHI^?-JB ^EHXF ¥XHA|0il£ 6HU01I ^^61 rjg^ 4 SICK 

h&ichi ibh^ ss&xiAi^H(iDs)g ^^ioh^ ¥^3oh m^-ias mm si^b eh^im 2¥ B\\mmx\ %m mx\ £^oi ^ohxi^ e 

XHIS0I SICK ^51, SER»*!0|| EH?L! AFOI^f Sfg S^Oil^ HH^i 1^x4 £sOI af 30% 01 ^ CH XI ^ 5!^^ ^&lXj °IEK 



gah^cni n ^^o\ sua. 



□ ^ l^^Al^ 4= LH|eo| B go, B^iAl^gjg X|| 



nasi ^£ ^ 

^ v ^m^i ^isfoi ^ ^se, aoii g^soH m^im ^s§i ^ sag iMia^ m§?a ^iy nej^Ai^gjoii siohah, & 

J\ a Oil S^£]CH HH^S 4S§I ^ HHeOH^e 2§i iTXIo^ US^XI ^|AH; ^ &J\ m&mX\ ^IAH^¥EH EH^Jg 4^6^01 2| 

4:^^ ^^u^M dl§& S^lg ^Xlo^ HEJ^XI AH OHM ^blohb 51^ ^S^^ 

3d|3 ^ ^SOil &OI ggmxi MAife °J25¥E1 EH^e 4-S6I-01 MbH6^ EH?J^S ^ ^tJH¥2f; Dl£l M^W XHSmn SICPf 4^1 
EH^ 4S ^ ^bH¥^¥EH EH^iHf bHQofQI ij^'f ^X|8^ EH S 0HS¥: 4>^l EHS DH^¥^¥EH EH!1!II &6tto^fe EH5L! 1»EH 

^ ^6H¥; ^ ^Ol EH^ ^EH^I ^ ^6H¥^¥EH CHI 01 EH M S'SJ^XI AitH^ S^S^I ^| » ^HH¥S 51^6f^ m 

Q. 



0I6K S 4 ¥^ S v S6F0j B ^S2| b^^El ^AIOIIS XUHISI ig6f;|g §hCf. 

^soii mm m^mx\M±mm ^gapi ?|6H seai& ssoiek e i# ^sfe, lh¥S(120)oi gm^oioe S5H sjeh yidoojoii 

S^SCH m¥&(120)0ll*r Ef42J 2^§i(1 21 -1 24)0! LAN^^ ^^£|0H 9JLQ. 3£|3 ^^£1^ EH^lMe ^AloPI g 

S^XIAI^gj (130)01 LH¥^(1 30)011 ^^£|0H 21 Ef. B ^' A I Oil Oil AH LH¥g^ 100Mbps2| 0|EH^°)0|3, m& OJEH^Oil^ Ef4°l 

s^MM3f EHDiy, H|eo, B Xfgjgoi S^£J0H 2iQ. 

?H^Si ^S^^ gJEi^dOO)^ TCP/IP ^^SMOil CCfS EH^M SoH LHIOIEH^I- S^£JH, £JEH£!(100)M mm LH¥^^^ EH 

^xh ^m^(no)e g6H ^ehus m lh¥^(i20)^^ mo\2_n, ui¥&(i20)oiiAi a^a^ mzims ^ wgou tn^ ui^?-ia ?i 
^ saanAi^B(i3o)oii hish ^ai&ck 

^of^jo^ goj^XI A|^^^ 3^1 CHI 01 El 4 S B3II, CHI 01 EH Pfg ^ ^ 
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SS^*! S UXI MID §J CHe 4B3I 

SfeO. CHIOIEH^S &3li= g^Al^^OI Qj^Al^yoil J9IS8hte e^'Oll AFg£|^ EH^§^ ^X|CH^o^¥Ei ^££J^r CHIOIEiS 

4>S6tfe &AH3I0IE1 ^SB^I^AH, PI S^Oil AHfe i^EOj y^OI Z>| l^£l Oi XI i= »HI2| SHIIfSOl &oo^ 0 | H^M^¥EH 2 

@ qioieo 4§5[2, uiB^ia ^i&ioii/dfe Lii§?ai mm s^si^ 2^ eh^§# 5>h^6ioi ^h&ck ^ss ^esj ^AmioiEHee chi 

Oi EH ^^B^llOllAi Di^mm^m 2|0|&±r ^^A|3|^ ? °1 g°'irX| B3||0||/Hfe OIM m^o\0\ £JS Oj¥f 51 § 

ssirxi E+^iife Ai^gsj uis^^ei Afeoii Qjo[ bxis ^^o^ aitn, Ai^g£i ^^soiu mm H^n^si tune oie^ ssexn 

= ^o^ 6^ XI Oil (H2| UI3& gJPI^a 2i BXIIJI^S ?^9Cf. g CUg B3||0IIA|fc §£JBX| Al^gJOl Al^gjBJ g£J0j¥M 

ess goiog go 0,0,1 q,s} ^go| cn§§ xi§2§ ?io^u s&aai xioii:hi ssa^s &n5to\ s&»eijkm 216H 2*1 

Oiae ggJittl Al^gg SSS^i 6^ S2J&XIB 9\m CHI 01 EH ^i=?lxl CHI 01 EH MH&S 

§01 ai^QI. S^Sii 2|^2S ^5 5[ 2 U |§Ah go, ^xi^g^ 2§ ifX|^g°^ =?«et4. CHI 01 EH ±±M ?ISi£g ^flofb gfgE 
BS s^^^¥EH £J£!£J ^AKHIOIEifi S SB XI Oil Algols UlSJiaK LHI 3011 01 £| a^§^¥£1 &AK3I0IEH* 4S 

o\o\ ^^m &x\o\$= am m.±= Dm. n&n m^asi m^i chioiehs ^smoi uij=?-ib sg>« bxish= lhm«3 ^1^2^ mmm 4 
sua. 

o\d\m, s.mm&o\& ai^soiu mm ±r^%\o\°\ mmw ai^soii m^m ^ aife gxis s^hehm mma. sg^xi ^soiiah^ 

0|2f 818 SXIS OH SOI 14 A|3LH|xj2| tlEH^ ^§8} s ggjsj gjgo| goif }|^§£! EH&jOlU AI3UI4H §§H BXIolfe 

&S0I14. 01 2f 1*01 2gSS B»»fflS 3|^2] g^Pie^OII CHS HHeOlU AI3UIXHS ^X|6^ ^SOIH^, P|^2| g^PIS^Oil 
CHe} EHeOlU AIHLHIxHS iDHf ^ ^^S^LPh 0^ i26ia. 01 CCH, HH&0IU AlZlUlxHM^ §^61 ggjoi 30^ ^p^5H^ ^ 2i 

£^ ^MOiX^O^ ofeCHI, 3^X1 S^Oll^ (false positive)^ §& v (false negatlve)OI 4* SICK 01 ^3 

xi ai^ &g nsn ^xioHy 4^ sixiei. ^bixixi ^si Afgs^ ^xi^ ^ gi^ esoi sick nam 2§ii o j ^xi^gg 
sxi9 chs^i ^^a^uoii s^^ai^h, aiulhixh^^. miMaiy], ^ehsoim^. e^^i^ ss^xi ^^sp. 

HlS^^ei ^XI^S^ Al^^j A^X^^ S^^oj °HsL"EH 510HU^ 3^m ^Xlo^ Al^g SE^ A^gXFHI S^ty^S PI 

mm ^AKHI01EHS¥EH 0\^^D[X\ eeH §^S?HS ^Sel s 4^t^£J^ A|^g)2| §^ty°H^¥EH ^CHUS S^M 

bi§4 h ^ej ty°H ^xig-g^ 2011 ^£ixi &g ty°HPi- ai^^oiiah ^^6^ g£j oient^ ui§^ h ^ei ^°h« exis^ cus^ 
el ^s? spu^i se^s o^ah M§im ai^^oi ^i^ai^j ^^ahi^2i ty°HS ^ta[2 ( ^i^°i ty?Hoii ^^m^m o\m h 

^m^e ^^6^ s°hhi ^§2^ ahi^£| ^nojuf ^nofs Aiei, AHi^eei ^^ahiah, Diieai, ci^b x\&s\ A[m& mo\u. oixng § 
&s°h ^^nf^e ^ A^xf ^ Ai^gj£j ly o ^p^ 3i^§s §^^°h^¥EH 5!chu^xi« &b^ck oisjohh bi§^s°Hg gxis^ 
^2Sb s^pui^s. ^iss> h , oii^ D[^m ime a^^s. Ah§x^ e^ 1 sess eoi 9x0. 

LHI^°=|B P|«[2| S'^'^XlAI^SfNIDS: Network-based IDS)^ LHI^^B EH^OIU SNMP MIB, §§ £3 S^ShOt 

Ij^'i mX\~}Q. NIDS^ UIM?-IB P|^2j ^XIS^OI LHI^°--JB 751 S^oHIXI- 6fe X0I =^2j CH¥^2| ^| 

^ S^i ITXIAI^gOllAi xHg ^§ s^M2| irXlo^LJ- &M\m D\mm ^ 2iCK NIDS^ SEe! 2^ ^BH^I^ mm 

^XISHOf SJteQI, LH|eo, 3 o, n^tfoil diejjS^OI CHg^£| ^dll^e ^Al^o^ ^^6^1 °H6HAH^ Mil d\\m ^3§ ^^A|^ ^fi^F 

ao. 

m\H LHI^?-]B 31 Bt S8JBIIAI^H(NIDS)a CH¥^ HI ^sj g ^^ = {NIC)« §5H U!^?=IB HH^^ 4^S8f01 ^#^^1 (Passive Analysis)e 

o\d\ mmou uim°-ib x^oii sai ^waiiHs ^xi mxidi mo\mo\. uim?-ib ^ /hi ^ xisoiie^ ^xims 2^1 uim?-iboii chsh 

xH El ^ 4^ 2iD. SE°[ Sr^MPI^^^ ^£1 UIM°-IB Pl&l SUEIi? ^§^25 H^^MOII ^Olo^ ^01 giU, BX| HH^IM 4S 

^^6^ S^XPF ^Pll ^All^^ ^ 2*201, If 5| AH S^XhOil^l in#£IX| ^A|^ ^ 2iCK 



£ 2£r S ^SOII CEhe LH|^o| B Dm §oiB X | A |Agoj £A ,ak M^SEOID. 

^ Oil me LHIM^B 31 g^'i^XlAI^^^ #^oj ^^£^01 cm^£|CH HH^Ol LH¥^(120)2f. Ui¥^0|l ^^SCH LH¥^°I S 

^ nH5L!e IS^iilolfe £i£JirXI ^ AH (IDS « Ai)(200)2f > IDS AH (200)011 AH IH^e ^^6^01 S'^M ^S6[i ^x|6fe IDS A|tH(280) 

S ^?a@C4. ^61, S ^S2| ^AIOIIOIIAH IDSAiW(280)^ N^H^I IDSAi tH S(280-1 ~280-n)0| A«OiS(load sharing) a^2| ^^^^^ 
3^30] IDS&(270)M g^l^o^Mi l^^l^ ^ Sl£^ SOi aiD. Hf£f AH SSi^XI « AH (200) ^¥ EH nH^Mg N 

3H°I IDSAiW(280-1~280-n)0|| ^^6MI g^£10j S^SCK OI ETH ^ IDS AHtH(S 2^£|^ uH^M^ HH^l ^EH^lg »Sj ^ 2i 
D. 

£ 2ft ^£612. SfflBXI ^AH(200)e nn^l a ^UH¥(210)2f, AM WfflH¥(220). EHe OHiJ¥(230). S EH ^ a ^ 5H ¥(240), m 

2 bHffl^l¥(250), ^HH¥(260)^ ^^£IOi B^l flH^M ^X|5^ 3l^2f iffl « M^olfe 31^. AHI CH g,^2S IDS^(270) 

Mlim ^bHSfe 3l^g xHai^QK 

B}|^ * ^bH¥(210)^ IPft ^X| 8>£r MPC860 OICH^] fe»(212)o^ S a OH LH¥Sr( 120)2] EH^e ^SShOI H1 1 WUH H¥(220)^ ^HH 
6^, «I1 mm^I¥(220)^ ^^3H2| ^(Dual-port RAM:222)H^ ^^9(4. EH^ OH^¥(230)^ XJl 1 WH-I ^¥(220)^1 m^o\£i M 

ZlWm 01 El LHSS 1031 dlHolOI ai^lOi^o^ 2 s s'^f ^X|SK4. 01 a e DHg¥(230)^ EI^2J iE °^HeHCHM PllOie Oi 
£l|OI(FPGA:232)S ?^@C4. 

I'EIg ^6H¥(240)^ MC68302 0101^(242)^^ ^Pe*£IOH nH^e goH& ^ ¥6F &EHS ^516101 ^§o| gdHelp. XII2 biIHg¥( 
250)^ ^^SM^(Dual-port RAM: 252)^^ ^^£|0] IDS AHbH(280)^ ^6H9 EH^g ^A| XHS6H2, ^HH¥(250)^ MPC860 01 CH 

^! S(262)^S ^?^£JCH HI2 tHffl 3 ¥(250)21 IDS^(270)M mm IDS A] W (280-1 ~280-n)^ Si?§.H4. 

2| IDS /HhH (280-1 ~280-n)^ EH^M ^^6f01 ^ IP^^ §^ *^IIfgJg ^^6101 dl§^ ^Xle^p. OH^HI EH 

?J ^^011 2J6H SSOI gX|£13 £2! ^£|XKUIM?I3 ^EIXf)0IMI 01 ft SXI^Q. 
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OI&0||Ai gg§h df2l »0|. B ^SOII »e 3IB SfflSXI Al^gj^ otESIIOI 3|B2| HHij 0H3S 0IS81HS 12 Oil AH *g M0\ 

&^(lost)oFX| ?H?ltt 4 2L^H^ nji^i ^(packet capture) S^g 100% Oil D\mn gf&Ali! 4> 2113. OlOil CTjaf °fO||Ai£| 
2§ mx\ dl§£r ty^lM S*8HHI BXItt 4 S80I ^6|. Ui^^Oil IPHOI S^SW 2^ EH^g 5Wfl» 

* s*jsi°s sejxkhi^i ±mm sa^t am. &goi bush ids ahwoji °ioh liim?-]b ^aixfooi sxkhi^oiu mti^vm mm ti^m 

>il Ohg£H SjSStTII CHgg 4= SL'SOI °[CK 

(57) §?S| g?| 

a?» i. 

^Oil 2^£|CH MUM ^Hff * SEie BX|8>fc UlS^a SSBAI^SOII °iCHAj, 
«3I SOII S^SJOi 4*SS s uH^OHge e5H 2§i ^Xl SFte SSigtXI >fU AH ; 

6*31 UStll £!Ai^¥Ei ^SS HH^M 4*£i6f01 2} HSnigf «S8Kn 01 S^M SXISJfe S8JSXI AHtflM ^dlohfe 2 

m 6^ me 91 3 ?m sagxi ai^h. 

S?» 2. 

All » Ml &OUH, SSiJI £!Ai£r 

36F01 ^X|of{= EH^ 0H^¥; &:>l fiH © 0H£l¥^¥Ei SBS EH3JS ^6H offe GH^l HEIgl §J ^§H¥; £>0| SH^i ^Ei^l a ^oH¥ 

£¥EH SBS Gil 01 EH M SSiirXI AHtfl^ 2B8IOI ?|*[ ^dH¥S 5§6ife f§og §>i= L||eoj B D \uy g|oj BJ | a|£S. 

3. 

*H 21*011 2a[CH AH , &3| HH©0H£l¥^ FPGA^ =?^Si^ ^1 fgog Wfc UIM?-i3 D\& SgJirXI Al^gj. 
4. 

HI 2 B«| £101A1, 6P| S3BXI £!Ai^ 

6Pi EH^i 4S ^ mm^s\ m^m hai wsspi «e xhi 1 wniu^i ch ?oib ^s^^ un?a pi&j- gg^xi ai^s. 
5. 

M2»0|| 2iCHAH, 6f5| §IEi^X| <M]Aife 

nn^i e eh ^ ^ ^oH¥2j s^e ^ai xiss^i ?\m M2 wwm^-m ch ^bi§[ si 6^ ^i&i sei^xi ai^^. 

a^lT 6. 

«i i »oii s^oiAH, 40, gojgxi AHm^ oich^m mm ¥m m&&°^ 3±m m%°^ ui^^jb ^i^ ssjbxi ai^s. 
a?» 7. 

^OHAH, ^>0| SS^XI AHbH^ S°JOI ^X|£IS 3 UigM QIOI EH WIOI^OII Xi§8H2 Li|^?-|3 ^E-IXfOil^il gXISF^ of 

£2 
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